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Abstract 
There is always a desire in the Internet community for unencumbered 
encryption algorithms with a range of key sizes that can provide 
security for a variety of cryptographic applications and protocols. 
This document describes an existing algorithm that can be used to 
satisfy this requirement. Included are a description of the cipher 
and the key scheduling algorithm, the s-boxes, and a set of test 


vectors (Appendix A). 
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Introduction 


This document describes the CAST-256 encryption algorithm, a DES-like 
Substitution-Permutation Network (SPN) cryptosystem built upon the 
CAST-128 encryption algorithm [1] which appears to have good 
resistance to differential cryptanalysis, linear cryptanalysis, and 
related-key cryptanalysis. This cipher also possesses a number of 
other desirable cryptographic properties, including avalanche, Strict 
Avalanche Criterion (SAC), Bit Independence Criterion (BIC), no 
complementation property, and an absence of weak and semi-weak keys. 
It thus appears to be a good candidate for general-purpose use 
throughout the Internet community wherever a cryptographically- 
strong, freely-available encryption algorithm is required. 


CAST-256 has a block size of 128 bits and a variable key size 
160, 192, 224, or 256 bits). 


(128, 


CAST-256 Algorithm Specification 


2.1 CAST-128 Notation 


The following notation from CAST-128 [1] is relevant to CAST-256. 
CAST-128 uses a pair of subkeys per round: a 5-bit quantity Kri 
is used as a "rotation" key for round i and a 32-bit quantity Kmi 


is used as a "masking" key for round i. 


Three different round functions are used in CAST-128. The rounds 
are as follows (where D is the data input to the operation, Ia - 
Id are the most significant byte through least significant byte of 
I, respectively, Si is the ith s-box (see Section 2.1.1 for s-box 
contents), and O is the output of the operation). Note that "+" 
and "-" are addition and subtraction modulo 2**32, "^" is bitwise 


eXclusive-OR, and "«««" is the circular left-shift operation. 
Type 1: I = ((Kmi + D) <<< Kri) 
O = ((Si[Ia] ^ S2[Ib]) - S3[Ic]) + S4[Id] 
Type 2: I = ((Kmi ^ D) <<< Kri) 
O = ((SllTa| - S2[Ib]) + S3[Ic]) ^ S4[Id] 
Type 3: I = ((Kmi - D) <<< Kri) 
O = ((Sl[Ia] + S2[Ib]) ^ S3[Ic]) - S4[Id] 
Let f1, £2, £3 be keyed round function operations of Types 1, 2, 
and 3 (respectively) above. 
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S1 - S4. These are defined as follows 


hexadecimal notation -- are to be read left-to-right, 


bottom). 


2.1.1 S-Boxes 


S-Box S1 

30fb40d4 9fa0ff0b 
bfd4af27 88bbbdb5 
28683b6f c07fd059 
alc9e0d6 346c4819 
66db40c8 a784392f 
b82cbaef d751d159 
4b6d2f7f 50bb64a2 
fd45c240 ad31973f 
882240f2 0c6e4f38 
blb6ab8a c71358dd 
3a787d5f 6276a0b5 
38901091 c6b505eb 
d7894360 425c750d 
64459eab 3f328b82 
81383f05 6963c5c8 
35e79e13 47da91d0 
548300d0 00322a3c 
6b54bfab 2b0b1426 
cfa4bd3f 2deaa3e2 
954329de adbe4528 
7b5a41f0 d37cfbad 
bf6bb16c 6a70fb78 
75bb0fc3 98511bfb 
3£04442f 6188b153 
c69dff09 c75b65f0 
f01144f9 d2240eb1 
580304f0 ca042cf1 
98a52666 5648f725 
aflfbda7 d4234870 
474d6ad7 7c0c5e5c 
bd91e046 9a56456e 
1a69e783 02cc4843 


S-Box S2 

1£201094 ef0ba75b 
ada7ef79 4e1d7235 
a0b52f7b 59e83605 
dlda4181 3b092abl 
1fc41080 179bee7a 
e113c85b acc40083 
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6beccd2f 
e2034090 
££2379c8 
61b76d87 
004dff2f 
6ff7f0ed 
d2664910 
c4f6d02e 
a4e4bfd7 
6385c545 
19a6fcdf 
84c7cb8c 
93b39e26 
7718c£82 
76cb5ad6 
f40f9086 
bf64cddf 
ab4cc9d7 
9e204d02 
d8710f69 
15069505 
0d03d9c9 
Affbcc35 
e0397a2e 
d9db40d8 
9675b3fd 
011a37ea 
ff5e569d 
a7870bf3 
d1231959 
dc39200c 
a2f7c579 


69e3cfle 
d55a63ce 
ee15b094 
f997f1c1 
d37ac6a9 
d7503525 


3f258c7a 
98d09675 
775£50e2 
22540f2f 
2db9d2de 
5a097alf 
bee5812d 
55fc8165 
4f5ba272 
110£935d 
7a42206a 
2ad75a0f 
187184c9 
59a2cea6 
d49974c9 
a7e2419e 
ba57a68e 
449ccd82 
c8bd25ac 
aa51c90f 
41ece491 
d4df39de 
b58bcf6a 
5727cb79 
ec0e7779 
a3ac3755 
8dbfaadb 
Oced63d0 
2d3b4d79 
38107298 
20c8c571 
429ef47d 


393f4380 
de0436ba 
e9ffd909 
a5e6cf7b 
fe5830a4 
f7ea615f 


1e213f2f 
6e63a0e0 
43c340d3 
2abe32e1 
97943fac 
827b68d0 
b7332290 
d5blcaad 
564cld2f 
57538ad5 
29f9d4d5 
874a1427 
6c00b32d 
04ee002e 
cal80dcf 
31366241 
75c6372b 
f7fbf265 
eadf55b3 
aa786bf6 
b4c332e6 
e01063da 
ellf0abc 
9ceb418f 
4744ead4 
d47c27af 
35ba3e4a 
7c63b2cf 
42e04198 
f5d2f4db 
962bdalc 
427b169c 


fe6lcf7a 
99c430ef 
dc440086 
01420ddb 
98de8b7f 
62143154 
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(s-boxes), 


(entries -- written in 


9c004dd3 
15c361d2 
df2f8656 
aa54166b 
4a97c1d8 
90ecf52e 
e93b159f 
alac2dae 
c59c5319 
6a390493 
£61b1891 
a2d1936b 
73e2bb14 
89fe78e6 
380782d5 
051ef495 
50afd341 
ab85c5f3 
d5bd9e98 
22513fle 
032268d4 
4736£464 
bfc5fe4a 
1cacd68d 
b11c3274 
51c85f4d 
3526ffa0 
700b45e1 
Ocd0ede7 
ab838653 
ele696ff 
5ac9f049 


eec5207a 
5£0c0794 
ef944459 
e4e7ef5b 
77e83f4e 
0d554b63 


6003e540 
c2e7661d 
887ca41a 
22568e3a 
527644b7 
22b0c054 
b48ee411 
a2d4b76d 
b949e354 
e63d37e0 
bb72275e 
2ad286af 
a0bebc3c 
3fab0950 
c7fab5cf6 
aa573b04 
a7c13275 
1b55db94 
e31231b2 
aa51la79b 
c9600acc 
5ad328d8 
a70aec10 
2ad37c96 
dd24cb9e 
56907596 
c37b4d09 
d5ea50f1 
26470db8 
6e2f1e23 
b141ab08 
dd8f0f00 


55889c94 
18dcdb7d 
ba83ccb3 
25alff41 
79929269 
54681121 


top-to- 


cf9fc949 
22d4ff8e 
a2d2bd2d 
a2d341d0 
b5f£437a7 
bc8e5935 
4bff345d 
c19b0c50 
b04669fe 
2a54f6b3 
aa508167 
aa56d291 
54623779 
325ff6c2 
8ac31511 
4a805d8d 
915a0bf5 
aad4e324 
2ad5ad6c 
2ad344cc 
ce387e6d 
b347cc96 
ac39570a 
0175cb9d 
7elc54bd 
a5bb15e6 
bc306ed9 
85a92872 
£881814c 
83719c9e 
7cca89b9 
5c8165bf 


72£c0651 
ald6eff3 
e0c3cdfb 
e180f806 
24fa9f7b 
c866c359 
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3d63cf73 
602f64a4 
10843094 
fc884f69 
e8256333 
c5d655dd 
54£03084 
eccf0ldb 
81ed6f61 
5e552d25 
a20c3005 
ee41e729 
73£98417 
50d99c08 
cdf0b680 
Taf 15673 
db2ffd5e 
b8da230c 
c72feffa 
61d9b8c6 
dc8637a0 
2d6a77ab 
5483697b 
b284600c 
8f5ea2b3 
43d79572 


S-Box S3 
8defc240 
beblf9bf 
11107d9f 
553fb2c0 
4e1a8302 
a8cO1db7 
99b03dbf 
b843c213 
a747d2d0 
8c96fdad 
efbd7d9b 
23efe941 
f8af918d 
ef303cab 
8b907cee 
5c76460e 
1£97c090 
68cc7bfb 
4b39fffa 
61bd8ba0 


cee234c0 
d63acd9c 
2537a95e 
3e4de8df 
84468212 
eb667064 
O66ff472 
a6d3d0ba 
20e74364 
5272d23 
8871df63 
6eld2d7c 
a1269859 
cb3f4861 
17844d3b 
2fdd5cdb 
8f32ce19 
80823028 
22822e99 
00024869 
16a7d3b1 
3527ed4b 
2667a8cc 
d835731d 
fc184642 
7e6dd07c 


25fa5d9f 
eefbcaea 
07647db9 
489ae22b 
bae07fff 
579fc264 
b5dbc64b 
6c0743f1 
1651192e 
5d2c2aae 
a672597d 
a903f12e 
4e48f79e 
984faf28 
b51fd240 
00ea983b 
081bdb8a 
d90f2788 
ba39aee9 
dile42d1 
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d4d87e87 
1bbc4635 
f46f6ffe 
ef0e0088 
128d8098 
77840b4d 
a31aa153 
b6803d5c 
b45e1378 
79d2951c 
b9de2fcb 
50045286 
ec645c44 
c26bd765 
3leef84d 
a11631c1 
306af97a 
dcdef3c8 
82c570b4 
b7ffce3f 
9£c393b7 
821fd216 
85196048 
dcb1c647 
0a036b7a 
06dfdfle 


eb903dbf 
e8cf1950 
b2e3e4d4 
d4ef9794 
528246e7 
67094f31 
638dc0e6 
8309893c 
af 70bf3e 
8ee99a49 
ada840d8 
60270df2 
8f616ddf 
779faf9b 
e7c07ce3 
d4d67881 
93a07ebe 
12490181 
a4ffd30b 
cead04f4 


5c672b21 
9e81032d 
alff3blf 
3559648d 
fed33fb4 
alb6a801 
dadc4755 
af77a709 
de18639b 
c60d894c 
Occ6c9e9 


071f6181 
2701f50c 
208cfb6a 
8a45388c 
ce280ae1 
84db26a9 
b5625dbf 
33b4a34c 
881ca122 
488cb402 
Obeeff53 


39f7627£ 
99847ab4 
8f458c74 
14804366 
27e19ba5 
e0b56714 
68561be6 
397bc8d6 
b96726d1 
lba4fe5b 
e3214517 


1e6685f3 
52c877a9 
64a3f6ab 
7e0824e4 
30f66f43 
02£03ef8 
a35fb171 
d8d94e89 
08dc283b 
a7136eeb 
095c6e2e 
8c4bacea 
ac4c56ea 
4fb089bd 
6c6cc4ef 


e810c907 
51df07ae 
3d4f285e 
125e3fbc 
8e57140e 
f2bd3f5f 
55819d99 
Ofeddd5f 
58c31380 
50da88b8 
45£54504 
0276e4b6 
e29d840e 
92dc560d 
e566b4al 
fd47572c 
b938cal5 
5de5ffd4 
faf7933b 
127ea392 


£33401c6 
cdff33a6 
80342676 
2ccb49eb 
b3faec54 
99319ad5 
088al1bc8 
8b1c34bc 
43daf65a 
c6bcc63e 
db92f2fb 
833860d4 
3ebd81b3 
649da589 
7160a539 


47607fff 
920e8806 
b9afa820 
21fffcee 
3373f7bf 
40fff7c1 
al97c81c 
2f7fe850 
5£98302e 
8427£4a0 
fa5d7403 
94fd6574 
842£7d83 
224d1e20 
c3e9615e 
f76cedd9 
97b03cff 
dd7ef86a 
6d498623 
10428db7 
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30a22c95 
a02b1741 
25a75e7b 
846a3bae 
157fd7fa 
c242fa0f 
bec0c560 
301e16e6 
f7e19798 
1a513742 
5eea29cb 
Od23e0f9 
230eabb0 
a345415e 
73bfbe70 


369fe44b 
f0ad0548 
fade82e0 
825blbfd 
8c9f8188 
1fb78dfc 
4a012d6e 
d7c07f7e 
727cc3c4 
leac5790 
e83ec305 
927985b2 
340ce5c8 
8437aa88 
3cf8209d 
bda8229c 
3dc2c0f8 
76a2e214 
193cbcfa 
8272a972 


361e3084 
a0e3df79 
d9e0a227 
721d9bfd 
d5a6c252 
21£043b7 
83ca6b94 
5ee22b95 
8049a7e8 
a4b09f6b 
b4542835 
31a70850 
7cbad9a2 
e4e6dlfc 
8ff77888 
ef8579cc 
a7e3ebb0 
61a3c9e8 
273be979 
7619b72£ 
ef6828bc 
145892f5 
6c387e8a 
6438bc87 
5c038323 
83877605 


8clfc644 
e13c8d83 
a067268b 
9255c5ed 
a6fc4ee8 
8e6bd2c1 
c5884a28 
02507fbf 
Oa0fb402 
796fb449 
4f91751a 
8276dbcb 
96bbb682 
7d29dc96 
6094d1e3 
127dadaa 
8dlab2ec 
b9a40368 
27627545 
9270c4a8 
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e4eb573b 
ba6cf38c 
4ec73a34 
a58684bb 
e49754bd 
e5d05860 
2d6ed23b 
5£0e5304 
22b7da7b 
1ca815cf 
9£63293c 
60930f13 
2180036f 
20c710e6 
ee5d60f6 
d152de58 
c68e4906 
bca8f54d 
bOffeaa6 
8f1c9ba4 
520365d6 
91584f7f 
0ae6d249 
f0b5blfa 
3e5d3bb9 
4523ecf1 


aececa90 
927010d5 
8272792e 
1257a240 
c982b5a5 
437be5 9b 
ccc36f71 
5afb9a04 
Of7fef82 
8252dc15 
925669c2 
02778176 
93b4b148 
2756d3dc 
cd9ca341 
438a074e 
64380651 
925d958f 
825cf47a 
127de50b 
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285balc8 3c62f44f 
1f081fab 108618ae 
d2d02dfe f8ef5896 
3a609437 ec00c9a9 
a2d02fff d2bf60c4 
a2048016 97573833 
94750001 570075d2 
6ea22fde 5f08ae2b 
67214cb8 ble583d1 
5727c148 2be98ald 
282£9350 833403602 
f7baefd5 4142ed9c 


S-Box S4 

9db30420 1fb6e9de 
7e287aff e60fb663 
28147f5f 4fa2b8cd 
ee4d111a 0fca5167 
80530100 e83e5efe 
ce84ffdf f5718801 
2649abdf aea0c7f5 
abe0502e ec8d77de 
40351805 7f3d5ce3 
a5bf6d8e 1143c44f 
26486e3e 8bd78a70 
69dead38 1574cal16 
bd59e4d2 e3d156d5 
e756bdff dd3369ac 
6e85cb75 be07c002 
20c763ef c366ab5fc 
6701902c 9b757a54 
026a4ceb 52437eff 
b7747£9d ab2af7b4 
61c2f50f 6552daf9 
63315c21 5e0a72ec 
d5cad3b6 0caec388 
ac07be6b cb44ald8 
6£7de532 58fd7eb6 
109873f6 00613096 
5ce2a465 a730£32c 
77079103 dea03af6 
d8eeb6d2 e523be77 
39e4460c 1fda8538 
b5676e69 9bd3ddda 
8644213e b7dc59d0 
7ae5290c 3cb9536b 
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35c0eaa5 
fcfd086d 
e4cf52da 
44715253 
d43£03c0 
d72074d67 
f9Db88f8 
af7a616d 
b7dc3e62 
8ab41738 
d91d1120 
a4315c11 


a7be7bef 
095f35al 
c9430040 
71ff904c 
ac9af4f8 
3dd64b04 
36338cc1 
57971e81 
a6c866c6 
43958302 
7477e4cl 
df871b62 
4fe876d5 
ec17b035 
c2325577 
9c382880 
31d477£7 
2f8f76b4 
efc34d20 
d2c231f8 
49bafefd 
£73001e1 
8b9b0f56 
d01ee900 
c32d9521 
d0aa3fe8 
78a8565e 
c2154529 
1987832f 
df7e052f 
7965291f 
851e20fe 
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e805d231 428929fb b4fcdf82 4fb66a53 0e7dcl15b 
f9ff2889 694bccll 236a5cae 12deca4d 2c3f8cc5 
95155b67 494a488c b9b6a80c 5c8f82bc 89d36b45 
0a874b49 d773bc40 7c34671c 02717ef6 4feb5536 
50b4ef6d 07478cd1 00661888 a2e53f55 b9e6d4bc 
deOf8f3d 72f87b33 abcc4f33 7688c55d 7b00a6b0 
8942019e 4264a5ff 856302e0 72dbd92b ee971b69 
e5c98767 cflfebd2 6lefc8c2 f1ac2571 cc8239c2 
7f10bdce f90a5c38 Off0443d 606e6dc6 60543a49 
20elbe24 af96da0f 68458425 99833be5 600d457d 
2b6d8da0 642b1e31 9c305a00 52bce688 1b03588a 
83323ec5 dfef4636 a133c501 e9d3531c ee353783 


d273a298 4a4f7bdb 64ad8c57 85510443 fa020edl 
79ebf120 fd059d43 6497b7b1 f3641f63 241e4adf 
0cc32220 fdd30b30 c0a5374f 1d2d00d9 24147515 
2d195ffe 1a05645f Ocl3fefe 081b08ca 05170121 
7fe72701 d2b8ee5f 06df4261 bb9e9b8a 7293ea25 
a26f263b 7ed48400 547eebe6 446d4ca0 6cf3d6f5 
503f7e93 d3772061 1150638e1 72500603 f80eb2bb 
el4f6746 c9335400 6920318f 081dbb99 ffc304a5 
5d5bcca9 daec6fea 9f926f91 9f46222f 3991467d 
d0214eeb 02208358 3fb6180c 18f8931e 281658e6 
b506e07c f32d0a25 790985002 e4eabb81 28123523 
211c40b7 a51a9ef9 0014377b 041e8ac8 09114003 
2£91a340 557be8de 00eae4a7 0ce5c2ec 4db4bba6 
06572327 99afc8b0 56c8c391 6b65811c 5e146119 
893ff4ec 5bbfc92d d0ec3b25 b7801ab7 8d6d3b24 
0ace3205 aac9548a ecald7c7 041afa32 1d16625a 
91265031 36cc6fdb c70b8b46 d9e66a48 56e55a79 
Odf980a5 8674cde3 edda04eb 17a9be04 2c18f4df 
2e096b7c 1741a254 e5b6a035 213d42f6 2c1c7c26 
25130f69 d8167fa2 0418f2c8 001a96a6 0d1526ab 
187908d9 8d0dbd86 311170a7 3e9b640c cc3e10d7 
6c728aff Tleae2al 1f9af36e cfcbd12f clde8417 
013988c3 blc52fca b4be3lcd d8782806 12a3a4e2 
24adffc2 f4990fc5 9711aac5 001d7b95 82e5e7d2 
adal21ff 29908415 7fbb977f af9eb3db 29c9ed2a 
8a5cc091 d49e2ce7 0ce454a9 d60acd86 015f1919 
dee356df 21f05cbe 8b75e387 b3c50651 b8a5c3ef 
2f69efdf afe67afb f470c4b2 f3e0eb5b d6cc9876 
ca007367 a99144f8 296b299e 492fc295 9266beab 
db25701c 1b5e51ee f65324e6 6afce36c 0316cc04 
ccd6fd43 41823979 932bcdf6 b657c34d 4edfd282 
9833557e 13ecf0b0 d3ffb372 3f85c5c1 0aef7ed2 
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2.2 CAST-256 Notation 
The following notation is employed in the specification of CAST-256. 
Let fl, £2, £3 be as defined for CAST-128. 


Let BETA = (ABCD) be a 128-bit block where A, B, C and D are each 
32 bits in length. 


Let "BETA «- Qi(BETA)" be short-hand notation for the following: 


( 
C = C ^ £1(D, KrO (i), KmO (i)) 
B- B^ £2(C, Krl (i), Kml (i)) 
A = A ^ £3(B, Kr2 (i), Km2 (i)) 
D = D ^ f1(A, Kr3 (i), Km3 (i)) 


Let "BETA «- QBARi(BETA)" be short-hand notation for the 


following: 
D = D ^ f1(A, Kr3 (i), Km3 (i)) 
A = A ^ £3(B, Kr2 (i), Km2 (i)) 
B-B^ £2(C, Krl (i), Kml (i)) 
C = C ^ £1(D, KrO (i), KmO (i)) 


(Q(*) is called a "forward quad-round" and QBAR(*) is called a 
"reverse quad-round".) 


Let Kr (i) = (KrO (i), Krl (i), Kr2 (i), Kr3 (i)) be the set of 
rotation keys for the ith quad-round, where Krj (i) is a 5-bit 
rotation key for fl, f2, or f3 (as specified above). 


Let Km (i) = (KmO (i), Kml (i), Km2 (i), Km3 (i)) be the set of 
masking keys for the ith quad-round, where Kmj (i) is a 32-bit 


masking key for fl, f2, or f3 (as specified above). 


Let KAPPA = (ABCDEFGH) be a 256-bit block where A, B, ..., H are 
each 32 bits in length. 


Let "KAPPA «- Wi(KAPPA)" be short-hand notation for the 


following: 
G = G ^ f1(H, TrO (i), TmO (i)) 
F=F * f2(G, Trl (i), Tml (i)) 
E = E ^ £3(F, Tr2 (i), Tm2 (i)) 
D-D^ f1(E, Tr3 (i), Tm3 (i)) 
C=C * £2(D, TrA (i), Tm4_(i)) 
B-B^ £3(C, Tr5 (i), Tm5 (i)) 
A=A ^ £1(B, Tr6 (i), Tm6 (i)) 
H = H ^ f2(A, Tr7 (i), Tm7 (i)) 


(W(*) is called a "forward octave".) 


Adams & Gilchrist Informational [Page 6] 


RFC 2612 The CAST-256 Encryption Algorithm June 1999 


Let "Kr (i) «- KAPPA" be short-hand notation for the 
following: Kr0 (i) = 5LSB(A), Kr1 (i) = 5LSB(C), Kr2 (i) = 
5LSB(E), Kr3 (i) = 5LSB(G) 

where 5LSB(x) denotes "the five least significant bits of x". 


Let "Km (i) «- KAPPA" be short-hand notation for the following: 
KmO (i) = H, Km1 (i) = F, Km2 (i) = D, Km3 (i) = B 


2.3 The CAST-256 Cipher 
BETA = 128bits of plaintext. 
for (i20; i«6; i++) 
BETA «- Qi(BETA) 


for (i26; i<12; i++) 
BETA «- QBARi (BETA) 


128bits of ciphertext - BETA 

Round Key Re-Ordering for Decryption 
The cipher employs a 256-bit primary key K.  Decryption is 
identical to encryption except that the sets of quad-round keys 


Kr (i), Km (i) derived from K are used in reverse order as 
follows. 


for (i20; i<12; i++) 


2.4 The CAST-256 Key Schedule 


Initialization: 
Cm = 2**30 * SQRT(2) = 5A827999 (base 16) 
Mm = 2**30 * SQRT(3) = 6ED9EBA1 (base 16) 
Cr = 19 
Mr = 17 
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for (i20; i«24; i++) 


for (j=0; j«8; ýtt) 


Tmj (i) = Cm 

Cm = (Cm + Mm) mod 2**32 
TJ- ti) = GE 

Cr = (Cr + Mr) mod 32 


) 
Key Schedule: 
KAPPA = ABCDEFGH = 256 bit of primary key, K. 


for (i=0; i<12; i++) 

{ 
KAPPA «- W2i (KAPPA) 
KAPPA «- W2i+1 (KAPPA) 
Kr (i) «- KAPPA 
Km (i) «- KAPPA 


Note: (|K| = 128) => (E = F = G = H = 0) 
([K| = 160) => (F = G = H = 0) 
(|K| = 192) => (G = H = 0) 
(|K| = 224) => (H = 0) 


Cipher Naming 


In order to avoid confusion when variable keysize operation is used, 
the name CAST-256 is to be considered synonymous with the name CAST6; 
this allows a keysize to be appended without ambiguity. Thus, for 
example, CAST-256 with a 192-bit key is to be referred to as CAST6- 
192; where a 256-bit key is explicitly intended, the name CAST6-256 
should be used. 


Cipher Usage 

The CAST-256 cipher described in this document is available worldwide 
on a royalty-free and licence-free basis for commercial and non- 
commercial uses. 


Security Considerations 


This entire memo is about security since it describes an algorithm 
which is specifically intended for cryptographic purposes. 
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Appendix A: Test Vectors 
Intermediate Values Known Answer Test. The data listed is: 


KEYSIZE-the current key length in bits 

KEY-the key in hexadecimal format 

PT-the plaintext to be encrypted 

R-the quad-round number (1 to 12) 

ROTK1, ROTK2, ROTK3, ROTK4=the rotation keys for the current quad-round 
MASK1,MASK2,MASK3,MASK4=the masking keys for the current quad-round 
OUT-the output of the quad-round 

CT-the ciphertext corresponding to the given plaintext. 


For each key size, an encryption and the corresponding decryption are 
shown. 


KEYSIZE-128 
KEY-2342bb9efa38542c0af£75647£29£615d 


PT-00000000000000000000000000000000 


R=1 
ROTK1-1c ROTK2-1d ROTK3-18 ROTK4=06 
MASK1=£364d7£9 MASK2=233500c0 MASK3=83cee501 MASK4-01f857c6 


OUT=e2c604af966715811b377£12de19e459 


R=2 
ROTKI=1e ROTK2=18 ROTK3=13 ROTK4=02 
MASK1-ae877786 MASK2=ef78852e MASK3-0aalc41f MASK4=a28ec9c4 


QOUT=5375c3be208f38eed0419d98f50dd9b3 


R=3 
ROTK1=02 ROTK2=1d ROTK3=01 ROTK4=0b 
MASK1=a3eedefb MASK2=ac426ecf MASK3=2e8220ec MASK4-cd92c34a 


OUT-732e4ec0f205e39afaf407c956d83728 


R=4 

ROTK1=0d ROTK2=1d ROTK3=04 ROTK4=12 
MASK1-3046827f MASK2=5 68ab6b9 MASK3=b8 6e7c10 MASK4=ef290a58 
OUT-af23fd837033dc81a60be8a69865c543 


R=5 
ROTK1=01 ROTK2=14 ROTK3=0c ROTK4=06 
MASK1=302e76c3 MASK2=cf429964 MASK3=e 9ecad47 MASK4=8850a515 


OUT=8b5e011401e1124£731135fa780c59ef 


R=6 
ROTK1=17 ROTK2=1d ROTK3=0e ROTK4=09 
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MASK1-bb903fdc MASK2-a9915d2f MASK3-0974e50a 


OUT=bdea3985cd08c7902096561b76f20944 


R=7 
ROTK1=03 ROTK2=13 ROTK3=07 


MASK1-13330f06 MASK2=5e1906f5 MASK3-fb2bce75 


OUT-438053fe465c299bcb35f£273b10ea71a 


R=8 
ROTK1=07 ROTK2=02 ROTK3=14 
MASK1-a29189c1 MASK2-dlaeff98 MASK3-c9b55ba7 


OUT=172c3a9a2791509d5939f58b703f2533 


R=9 
ROTKI=1c ROTK2=08 ROTK3=1f 
MASK1=5687e118 MASK2=bc4f5d80 MASK3=cca4c042 


OUT=79178d5£90187732£8007£d3884cc309 


R=10 
ROTK1=15 ROTK2=12 ROTK3=04 
MASK1=cdb18671 MASK2-f06a3c64 MASK3-0c7031f9 


OUT-e9e2b1f23e82479baec3b3b35fdf890f 


R-11 
ROTK1-1f ROTK2-1a ROTK3=01 
MASK1=317654b5 MASK2-a1433222 MASK3-f6d8c69f 


OUT=1£3270101b2b38adc4818ca2Zaafc334a 


R=12 
ROTK1=0b ROTK2=11 ROTK3-0f 


MASK1-9339b14f MASK2=971d14bb MASK3-f3b7ca97 


OUT=c842a08972b43d20836c91d1b7530f£6b 


CT=c842a08972b43d20836c91d1b7530f£6b 


R=1 
ROTK1=0b ROTK2=11 ROTK3=0f 


MASK1-9339b14f MASK2=971d14bb MASK3-f3b7ca97 


OUT=1£3270101b2b38adc4818ca2Zaafc334a 


R=2 
ROTK1-1f ROTK2-1a ROTK3=01 
MASK1=317654b5 MASK2-a1433222 MASK3-f6d8c69f 


OUT-e9e2b1f23e82479baec3b3b35fdf890f 


R23 
ROTK1-15 ROTK2-12 ROTK3=04 
MASK1=cdb18671 MASK2-f06a3c64 MASK3-0c7031f9 
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MASK4-0c1708f1 


ROTK4=0e 
MASK4-8331aed4 


ROTK4-14 
MASK4=c149f70c 


ROTK4-1f 
MASK4=bab3f£b68 


ROTK4=0f 
MASK4=7dfbff4e 


ROTK4=0e 
MASK4=304dfbeb 


ROTK4=18 
MASK4=2b8a06f9 


ROTK4=18 
MASK4=2b8a06f9 


ROTK4-0e 
MASK4=304dfbeb 


ROTK4=0f 
MASK4=7dfbff4e 
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OUT-7917845£90187732£8007£4d3884cc309 


R=4 
ROTKI=1c ROTK2=08 ROTK3=1f ROTK4=1f 
MASK1=5687e118 MASK2=bc4f5d80 MASK3=cca4c042 MASK4-bab3fb68 


OUT=172c3a9a2791509d5939F58b703£2533 


R=5 
ROTK1=07 ROTK2=02 ROTK3=14 ROTK4=14 
MASK1-a29189c1 MASK2-dlaeff98 MASK3=c9b55ba7 MASK4=c149f70c 


OUT=438053fe465c299bcb35f273b10ea71a 


R=6 

ROTK1=03 ROTK2=13 ROTK3=07 ROTK4=0e 
MASK1-13330f06 MASK2=5e1906f5 MASK3-fb2bce75 MASK4-8331aed4 
OUT=bdea3985cd08c7902096561b76f20944 


R=7 

ROTK1=17 ROTK2=1d ROTK3=0e ROTK4=09 
MASK1-bb903fdc MASK2-a9915d2f MASK3-0974e50a MASK4-0c1708f1 
OUT-8b5e011401e1124£731135£a780c59ef 


R=8 
ROTK1=01 ROTK2=14 ROTK3=0c ROTK4=06 
MASK1=302e76c3 MASK2=cf429964 MASK3-e9ecad47 MASK4-8850a515 


OUT-af23fd837033dc81a60be8a69865c543 


R=9 

ROTK1=0d ROTK2=1d ROTK3=04 ROTK4=12 
MASK1-3046827f MASK2=568ab6b9 MASK3=b86e7c10 MASK4=ef290a58 
OUT-732e4ec0f205e39afaf407c956d83728 


R=10 
ROTK1=02 ROTK2=1d ROTK3=01 ROTK4=0b 
MASK1=a3eedefb MASK2=ac426ecf MASK3=2e8220ec MASK4-cd92c34a 


QOUT=5375c3be208f38eed0419d98f50dd9b3 


R=11 
ROTKI=1e ROTK2=18 ROTK3=13 ROTK4=02 
MASK1-ae877786 MASK2=ef78852e MASK3-0aalc41f MASK4=a28ec9c4 


OUT=e2c604af966715811b377£12de19e459 


R=12 
ROTK1-1c ROTK2-1d ROTK3-18 ROTK4=06 
MASK1-f364d7f9 MASK2-233500c0 MASK3-83cee501 MASK4-01f857c6 


OUT-00000000000000000000000000000000 


PT-00000000000000000000000000000000 
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KEYSIZE-192 


KEY-2342bb9efa38542cbed0ac83940ac298bac77a7717942863 


PT-00000000000000000000000000000000 


R=1 
ROTK1-1e ROTK2-1a ROTK3=1b 
MASK1=21daa501 MASK2=fcdfc612 MASK3=62f£629b3 


OUT-4d468c8ca43c1ab66eae0bb9062fe876 


R-2 
ROTK1-1a ROTK2-1d ROTK3-19 
MASK1-d7f04aaf MASK2=76a4b0c2 MASK3=7364327b 


OUT=1fd808cfd82ac7354728e719a4cc0ebe 


R=3 
ROTK1-13 ROTK2-19 ROTK3-15 
MASK1=c5b5a24e MASK2=20577cc0 MASK3-e58b12aa 


OUT=d3507d51934db5335cebdbb550b774b6 


R=4 
ROTK1=0f ROTK2=00 ROTK3=15 
MASK1=5b1b847c MASK2=3d700297 MASK3-310383e1 


OUT-fab3a20243c1c67bf1759£40c45732e8 


R-5 
ROTK1=01 ROTK2=0f ROTK3-0f 
MASK1-34422fa1 MASK2-745d0d3c MASK3-0804535e 


OUT=cf003a27ba91d2346ddfa8ec7 6bdf029 


R=6 
ROTK1=06 ROTK2=10 ROTK3=06 
MASK1-aeb5e85f6 MASK2=d1f789b0 MASK3=e2113794 


OUT-b4fb78a74bbacccbfa45c36c23ed997e 


R27 
ROTK1=09 ROTK2=1d ROTK3=08 
MASK1=1a000d83 MASK2=dc6d0e51 MASK3=3b65ccaf 


OUT=1cedb6d94abb223765f0fb9364a8f07f 


R=8 
ROTK1=09 ROTK2=0a ROTK3=01 


MASK1=d500ec2c MASK2-77e23f6f MASK3=3d1422b2 


OUT=b3289009a03b021d54cec6628712c165 
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ROTK4=16 
MASK4=9ec93bfa 


ROTK4=1f 
MASK4=fe0602c3 


ROTK4=18 
MASK4-a87da0f1 


ROTK4=08 
MASK4=ala19785 


ROTK4=11 
MASK4=42de73d8 


ROTK4=07 
MASK4=db8768c0 


ROTK4-1f 
MASK4=b0470998 


ROTK4=0d 
MASK4=0e4c04aa 
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R=9 
ROTK1-1b ROTK2-0d ROTK3=0b ROTK4=14 
MASK1-f9b1a192 MASK2-aded6200 MASK3-0fc10d02 MASK4-d8bdb797 


OUT-a4d8f6d0abd8613d241fff3c2ba02882 


R=10 
ROTK1=17 ROTK2=1d ROTK3=1c ROTK4=17 
MASK1=a81550e2 MASK2=44e56b22 MASK3-ac97284c MASK4-e1021ad2 


OUT-61a3f74a9a5dal18d53a25ce8f3302357 


R=11 

ROTK1=19 ROTK2-1e ROTK3-11 ROTK4=02 
MASK1=b09d0346 MASK2=15167c69 MASK3=19990bbd MASK4=a9258551 
OUT-ca5ad45111a662£740c9a94b1d43dfb6 


R-12 
ROTK1-10 ROTK2-0d ROTK3=08 ROTK4=01 
MASK1=69d0c348 MASK2=c8a3d81d MASK3=d2714d62 MASK4-8cc3f35a 


OUT-10386c0210dcadcbdd0e41aa08a7a7e8 


CT-2150386c0210dcadcbdd0e41aa08a7a7e8 


R=1 
ROTK1=10 ROTK2-0d ROTK3=08 ROTK4=01 
MASK1=69d0c348 MASK2=c8a3d81d MASK3=d2714d62 MASK4-8cc3f35a 


OUT-ca5ad45111a662f£740c9a94b1d43dfb6 


R=2 

ROTK1=19 ROTK2=1e ROTK3=11 ROTK4=02 
MASK1=b09d0346 MASK2=15167c69 MASK3=19990bbd MASK4=a9258551 
OUT-61a3f74a9a5da18d53a25ce8f£3302357 


R=3 
ROTK1=17 ROTK2=1d ROTK3=1c ROTK4=17 
MASK1=a81550e2 MASK2=44e56b22 MASK3=ac97284c MASK4=e1021ad2 


OUT-a4d8f6d0abd8613d241fff3c2ba02882 


R=4 
ROTK1-1b ROTK2-0d ROTK3=0b ROTK4=14 
MASK1-f9b1a192 MASK2-aded6200 MASK3=0fc10d02 MASK4=d8bdb797 


OUT=b3289009a03b021d54cec6628712c165 


R=5 
ROTK1=09 ROTK2=0a ROTK3=01 ROTK4=0d 
MASK1=d500ec2c MASK2=77e23f£6f MASK3=3d1422b2 MASK4=0e4c04aa 


OUT=1cedb6d94abb223765f0fb9364a8f07f 
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R=6 
ROTK1=09 ROTK2=1d ROTK3=08 ROTK4-1f 
MASK1-1a000d83 MASK2-dc6d0e51 MASK3-3b65ccaf MASK4=b0470998 


OUT-b4fb78a74bbacccbfa45c36c23ed997e 


R=7 
ROTK1=06 ROTK2=10 ROTK3=06 ROTK4=07 
MASK1-aeb5e85f6 MASK2=d1£789b0 MASK3=e2113794 MASK4=db8768c0 


OUT=cf003a27ba91d2346ddfa8ec7 6bdf029 


R=8 
ROTK1=01 ROTK2-0f ROTK3-0f ROTK4-11 
MASK1-34422fa1 MASK2-745d0d3c MASK3-0804535e MASK4-42de73d8 


OUT=fab3a20243clc67bf1759F40c4b732e8 


R=9 
ROTK1=0f ROTK2=00 ROTK3=15 ROTK4=08 
MASK1=5b1b847c MASK2=3d700297 MASK3-310383e1 MASK4=ala19785 


OUT=d3507d51934db5335cebdbb550b774b6 


R=10 
ROTK1=13 ROTK2=19 ROTK3=15 ROTK4=18 
MASK1=c5b5a24e MASK2=20577cc0 MASK3-e58b12aa MASK4-a87da0f1 


OUT-1fd808cfd82ac7354728e719a4cc0ebe 


R-11 
ROTK1-1a ROTK2-1d ROTK3-19 ROTK4-1f 
MASK1-d7f04aaf MASK2=76a4b0c2 MASK3=7364327b MASK4=fe0602c3 


OUT-4d468c8ca43c1ab66eae0bb9062fe876 


R-12 
ROTK1-1e ROTK2-1a ROTK3=1b ROTK4=16 
MASK1=21daa501 MASK2=fcdfc612 MASK3=62f£629b3 MASK4=9ec93bfa 


OUT=00000000000000000000000000000000 


PT=00000000000000000000000000000000 


KEYSIZE=256 
KEY=2342bb9efa38542cbed0ac83940ac2988d7c47ce264908461cc1b5137ae6b604 


PT=00000000000000000000000000000000 
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R=1 
ROTK1=08 ROTK2=12 ROTK3=0e ROTK4=17 
MASK1-420b1cef MASK2-03f07e80 MASK3-cd2ab3ee MASK4-15371a16 


OUT-f6c3b9a6ffd8a31ce04dbcf7772£1536 


R=2 
ROTK1=0a ROTK2=04 ROTK3=01 ROTK4=13 
MASK1=bc6025e3 MASK2=d54f5aba MASK3=17fa667a MASK4=bb8a840e 


OUT-9477ef6fd7d6fce3dcaa27d6132465ee 


R-3 
ROTK1-1e ROTK2-0d ROTK3-10 ROTK4=01 
MASK1=446c0950 MASK2=b4542da0 MASK3=523baa91 MASK4=4a914503 


OUT-c056ec5748ecd90f992cf07£3529160f 


R=4 
ROTK1=15 ROTK2=0e ROTK3-0d ROTK4=09 
MASK1-4106d4de MASK2-9ce441e7 MASK3-2c390c3b MASK4=52d1b516 


OUT=7bcc57d80603b6c7b9caT5eea5chlic2d 


R=5 
ROTK1=09 ROTK2=16 ROTK3=08 ROTK4=16 
MASK1=2827db72 MASK2-7920623f MASK3=10948ala MASK4=b639£290 


OUT=d62686a2b01d11837fb6a46c79FC1816 


R=6 
ROTK1-1f ROTK2-11 ROTK3=17 ROTK4=0a 
MASK1=85fcd124 MASK2=c567c5fe MASK3=a4113025 MASK4=ce 949239 


OUT=1b03a108d6f1878e03a62e72C9C97662 


R=7 

ROTK1-1d ROTK2=06 ROTK3=0b ROTK4-1c 
MASK1=c0e98900 MASK2=8832532c MASK3-d7403525 MASK4-26ed4609 
OUT=b11d972£22ed26d085189ca3b6c79d36 


R=8 
ROTK1=0b ROTK2=04 ROTK3=0e ROTK4=19 
MASK1=69b1d027 MASK2=e628d930 MASK3=4904b3cd MASK4-51fad71a 


OUT-4265774a393a8a32ed78c5c1571893e4 


R=9 

ROTK1-1a ROTK2-0f ROTK3=09 ROTK4=10 
MASK1=4b81b846 MASK2-9f1d941b MASK3-ebb8fe8a MASK4=6616847e 
OUT-f4f1322a076d4f5eb2d14dc75815ccf1 
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R=10 
ROTK1-1b ROTK2=00 ROTK3=01 ROTK4=01 
MASK1-2cf3fd07 MASK2=75580ec1 MASK3=513614b9 MASK4=478097ef 


OUT-57c3a554eafe71dc6a33fe0bda83f566 


R-11 

ROTK1-1c ROTK2=0b ROTK3=1b ROTK4-1f 
MASK1=4fdf26fe MASK2=a4850785 MASK3=615eadd0 MASK4=9b507d47 
OUT-dd9940f4f2e1786ab6f2bdee519a407e 


R=12 

ROTK1=0f ROTK2=09 ROTK3=1d ROTK4=02 
MASK1=4bd673d3 MASK2=36399d66 MASK3=63385006 MASK4-0579675f 
OUT-4f6a2038286897509c9870136553317fa 


CT-4£6a203828689709c9870136553317fa 


R=1 

ROTK1-0f ROTK2=09 ROTK3=1d ROTK4=02 
MASK1=4bd673d3 MASK2-36399d66 MASK3=63385006 MASK4-0579675f 
OUT-dd9940f4f2e1786ab6f2bdee519a407e 


R=2 

ROTKI=1c ROTK2=0b ROTK3=1b ROTK4=1f 
MASK1=4fdf26fe MASK2=a4850785 MASK3=615eadd0 MASK4=9b507d47 
OUT-57c3a554eafe71dc6a33fe0bda83f566 


R23 
ROTK1-1b ROTK2=00 ROTK3=01 ROTK4=01 
MASK1-2cf3fd07 MASK2-75580ec1 MASK3=513614b9 MASK4=478097ef 


OUT-f4f1322a076d4f5eb2d14dc75815ccf1 


R=4 

ROTK1-1a ROTK2-20f ROTK3=09 ROTK4=10 
MASK1=4b81b846 MASK2-9f1d941b MASK3-ebb8fe8a MASK4-6616847e 
OUT-4265774a393a8a32ed78c5c1571893e4 


R=5 
ROTK1=0b ROTK2=04 ROTK3=0e ROTK4=19 
MASK1=69b1d027 MASK2-e6284d930 MASK3=4904b3cd MASK4-51fad71a 


OUT=b11d972£22ed26d085189ca3b6c79d36 


R=6 

ROTK1-1d ROTK2=06 ROTK3=0b ROTK4-1c 
MASK1=c0e98900 MASK2=8832532c MASK3-d7403525 MASK4-26ed4609 
OUT-1b03a108d6f1878e03a62e72c9c97662 
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R27 
ROTK1-1f ROTK2-11 ROTK3=17 ROTK4=0a 
MASK1=85fcd124 MASK2=c567c5fe MASK3=a4113025 MASK4=ce 949239 


OUT=d62686a2b01d11837fb6a46c79FC1816 


R=8 
ROTK1=09 ROTK2=16 ROTK3=08 ROTK4=16 
MASK1=2827db72 MASK2-7920623f MASK3=10948ala MASK4=b639£290 


OUT=7bcc57d80603b6c7b9caT5eea5chlc2d 


R=9 
ROTK1=15 ROTK2=0e ROTK3=0d ROTK4=09 
MASK1-4106d4de MASK2-9ce441e7 MASK3-2c390c3b MASK4=52d1b516 


OUT=c056ec5748ecd90f992cf07f£3529160f 


R=10 
ROTK1-1e ROTK2-0d ROTK3-10 ROTK4=01 
MASK1=446c0950 MASK2=b4542da0 MASK3=523baa91 MASK4=4a914503 


OUT-9477ef6fd7d6fce3dcaa27d6132465ee 


R-11 
ROTK1=0a ROTK2=04 ROTK3=01 ROTK4=13 
MASK1=bc6025e3 MASK2=d54f5aba MASK3=17fa667a MASK4=bb8a840e 


OUT-f6c3b9a6ffd8a31ce04dbcf7772£1536 


R-12 
ROTK1=08 ROTK2=12 ROTK3=0e ROTK4=17 
MASK1-420b1cef MASK2=03£07e80 MASK3=cd2ab3ee MASK4-15371a16 


OUT-00000000000000000000000000000000 


PT-00000000000000000000000000000000 
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